w32 dupator virus-how can i remove it?

[Pammi1958]

On start up I kept getting an error in kernel32 in explorer. I ran mcafee virus scan and it foundw 32 dupator. I could clean all the files but hpsysdrv usbmmkybd and systray. It tried to clean, and couldn't, then tried to delete, but couldn't. I tried to replace files but of course Windows would not allow that. I went to "mcafee help" (is that an oxy-moron?) They told me to diable system restore. I did. Scanned again and still the same thing. I think its clean and when I reboot and scan again it finds all the infected files all over again. I went to mcafee again and they told me how to scan in DOS mode. There were still folders it couldn't open, and the virus is still there. Anyone have any ideas? My virus dat files and engine is up to date. I have Mcafee 7.01.6000.
Thanks

 

[Rollin' Rog]

It sounds like you are going to have to restore both the kernel32.dll, systray.exe and your HP keyboard drivers.

Kernel32.dll is a protected system file, and you will have to follow the procedure here to restore it:

http://support.microsoft.com/default.aspx?scid=KB;en-us;q265371

 

[Pammi1958]

I tried to extract and replace files, ran scan in dos mode. it said it cleaned the virus, but there were IE files it couldn't open. I rebooted and the virus was still there.
Boy do I HATE Mcafee. Their resolution is to uninstall/reinstall. How creative. Thats probably the first thing listed in their generic data base.

 

[Rollin' Rog]

You say, you tried to extract and replace files; was this done successfully with kernel32.dll and systray.exe? If not where did you encounter a problem? Always note exact error messages when possible. You may need to replace kernel32.dll using a WinME boot disk to access the DOS extract command.

On rebooting you say the virus is still there? Where? What is the name of the infected file(s) and the full path to it?

Are the keyboard drivers still being listed as "infected"?

Can we see a post of startups using the Startuplist application from the site below, just download, unzip and run it -- then copy/paste the results to a reply.

http://www.lurkhere.com/~nicefiles/

The virus scan not being able to open certain IE files is not necessarily a problem.

 

[Pammi1958]

By the time i was done uninstalling mcafee, i could not even start windows, so i put in the restore disk and tried to restore factory system files. when it was finished i rebooted and i got a error message saying it could not load kernel 32, reinstall windows. So, i opted for the last ditch effort and restore and format. So, i hope that wiped out the evil files. But now I have to uninstall mcafee v shield 4.0. wee.
I had win 98 on that pc and upgraded to win me. i am in the prcess of doing that now. i hope this cures it.
i know too much and not enough
this get me in trouble!
Pam

 

[Rollin' Rog]

If you did a restore with format, then you completely wiped all files off the system, McAfee would only be there if it came with the original installation. Anyway good luck on the restoration, and yes I would get rid of any original McAfee programs too.